Splunk is not starting on indexer

[Prakash493]

Hi , i have an issue our one of indexer goes down because it says unable to start because splunk is unable to read the file from following location. Please check the permissions.

Is it really a permission issue if splunk is unable to read a file from a directory ?

[ashwinm]

We need to make sure that the permissions are given for the splunk user and splunk is running as a splunk user rather than a root user.

[vishaltaneja070]

Hello @Prakash493

1. Splunk setup is on Linux?
2. Splunk is running by which user?

[skalliger · Accepted solution]

Did you install Splunk as root and are trying to start it with another user now? Are all files owned by the correct user? Without further information, we can only guess.

Skalli

[Prakash493]

Yes installed by admin and i am user but before i am able to start and stop not now

[Prakash493]

Correct i changed as a user and performed as root and everythink works fine

[nvanderwalt_spl]

If Splunk was started as root at any time, some files will now belong to root, and you will have to chown everything in the Splunk install directory back to the user that is supposed to own it.